Docker Certified Associate (DCA) key terms

A lightweight, isolated runtime environment created from an image. It packages an application and its dependencies, shares the host kernel, and starts far faster than a virtual machine.

An immutable, layered filesystem template plus configuration metadata from which containers are created. Images are built once, stored in registries, and reused across hosts.

A text file of ordered instructions that describes how to build an image. Each instruction typically produces a new layer, and the build runs top to bottom with caching.

A read-only filesystem diff produced by a build step or image pull. Layers are content-addressed and shared between images, which reduces storage and transfer size.

Reusable results of previous build instructions. Docker reuses a cached layer when the instruction and its inputs are unchanged, so ordering instructions well speeds up rebuilds.

The set of files sent to the builder at the start of a build, usually the directory named on the build command. Large contexts slow builds, so a .dockerignore file trims them.

A Dockerfile technique using several FROM stages where later stages copy only needed artifacts from earlier ones. It keeps compilers and build tooling out of the final runtime image.

A storage strategy where containers share read-only image layers and write changes to a thin writable layer. Unmodified files are never duplicated, saving disk space and start time.

Persistent storage managed by Docker and mounted into containers, stored outside the container filesystem. Volumes survive container deletion and are the preferred way to keep stateful data.

A host file or directory mapped directly into a container path. It is useful for development and configuration but depends on host layout and permissions, unlike a managed volume.

An in-memory mount available to Linux containers that is never written to disk. It suits sensitive temporary data such as secrets or scratch files that should vanish with the container.

A Linux kernel feature that gives a process its own isolated view of a resource such as processes, network interfaces, mounts, or hostnames. Containers rely on several namespaces at once.

A Linux kernel mechanism that limits and accounts for resource use such as CPU, memory, and block I/O by a group of processes. It enforces container resource constraints.

Fine-grained Linux privilege units that can be granted or dropped per process. Dropping unneeded capabilities, such as NET_RAW, reduces the damage a compromised container can cause.

A Linux facility that filters which system calls a process may make. Docker applies a default profile that blocks risky calls, and custom profiles can restrict containers further.

A Linux mandatory access control system that confines programs by profile. Docker can attach a profile to a container to restrict file and network access beyond default permissions.

The core runtime made of a daemon, a REST API, and a command-line client. The daemon builds images and runs containers; clients such as docker CLI talk to it over a socket.

The long-running Docker daemon process that receives API requests, manages images, networks, and volumes, and delegates container execution to a lower-level runtime.

An industry-standard container runtime that manages the full container lifecycle, including image transfer and storage, on behalf of the Docker daemon and other orchestrators.

A lightweight Open Container Initiative runtime that creates and starts containers from a bundle specification. It is the low-level tool containerd invokes to launch a container process.

A small per-container process that keeps a container's standard streams and exit status alive after the managing daemon restarts. It decouples container lifetime from the daemon.

The Open Container Initiative, which publishes open specifications for image format and runtime behavior. Compliance lets images and runtimes from different vendors interoperate.

A networked service that stores and distributes container images by repository and tag. Clients pull images from it and push newly built images back to it.

A human-readable label such as latest or 1.4 pointing to a specific image version in a repository. Tags are mutable, so production deployments should pin something stronger.

A content-addressed identifier computed from an image manifest, written as an algorithm and hex string. Unlike a tag, it always refers to exactly the same image content.

A tool that defines multi-container applications in a YAML file, including services, networks, and volumes. One command creates and starts the whole set on a single host.

The default Docker network driver for containers on one host. It provides a private subnet, embedded DNS for service names, and outbound NAT, and supports user-defined isolation.

A Docker network driver that spans multiple hosts, encapsulating traffic between containers on different nodes. It underpins Swarm services and requires a key-value store for discovery.

Mapping a host port to a container port so external clients can reach the service. It is expressed with -p or the ports key and handled by the host's NAT rules.

A named connection profile storing the endpoint, TLS certificates, and orchestrator setting a CLI uses. Switching contexts points the same client at a different daemon or cluster.

The native clustering mode of Docker Engine, where manager nodes schedule services and worker nodes run tasks. It provides service discovery, scaling, and rolling updates without extra software.

A declarative Swarm object describing a desired container image, replica count, network, and update policy. Swarm continuously reconciles running tasks to match that desired state.

The smallest scheduling unit in Swarm: one container instance assigned to a node for a service replica. If a task fails, the orchestrator creates a replacement.

A command Docker runs inside a container to test whether it is actually working, not just running. Results appear as healthy or unhealthy and can drive orchestration decisions.

Running the Docker daemon and containers without root privileges by using user namespaces. It reduces host risk from daemon compromise, at the cost of some networking limitations.

Docker Trusted Registry, the enterprise image registry component of Docker Enterprise. It adds role-based access, image signing, and scanning to a private, on-premises registry.

Universal Control Plane, the Docker Enterprise cluster management product. It provides a web UI and API over Swarm and Kubernetes, with centralized access control and team-based resource grants.

A Docker feature that verifies image signatures before pull or push using keys managed by the Notary service. It prevents running images that were not signed by a trusted publisher.

Analysis of an image's packages against vulnerability databases to report known CVEs. Enterprise registries can scan on push and block deployment of images above a severity threshold.